Click HERE to take a look at the study guide TOC in PDF format.

SAMPLE TEXT on introduction to internal auditing
 

The goal of Internal Auditing is to support executive management and the board of directors in carrying out corporate governance. In a broader sense, the objective of internal auditing can be seen as assisting members of the organization in the effective discharge of their responsibilities. To achieve such purpose, internal auditing furnishes them with analyses, appraisals, recommendations, counsel, and information concerning the activities reviewed.

The typical goals of Internal Auditing may include:
- Evaluating the soundness and adequacy of the internal control structure.
- Assessing compliance with policies, plans, procedures, laws, and regulations.
- Verifying the existence of assets and ensuring that they are properly accounted for and safeguarded from losses of all kinds.
- Conducting special examinations and reviews requested by management including investigating reported occurrences of fraud, embezzlement, theft, waste, etc., and recommending controls to prevent or detect such occurrences.
- Evaluating the economy and efficiency with which resources are employed, and recommending improvements in operations.
- Evaluating the reliability and integrity of management data by reviewing general controls and computer security procedures over data processing.
- Determining the extent to which established objectives and goals for operations or programs are being accomplished.

SAMPLE TEXT on internal controls

 

A Control Environment entails the attitude and actions of the board and the top management regarding the significance of control within the organization. It provides the discipline and structure for the achievement of the primary objectives of internal control. The essential control environment elements are:

- Integrity and ethical values
- Management’s philosophy and operating style
- Organizational structure
- Assignment of authority and responsibility
- Human resource policies and practices
- Competence of personnel

A system of internal control is not without risks. For example, there could be detection risk - the probability that an incorrect audit conclusion will be drawn due to failure of detecting any serious errors. There could also be control risk - the tendency of the internal control system to lose effectiveness over time.

Types of control include:

- Detective controls identify undesirable outcomes that have occurred. In other words, these controls start to function after the event has taken place.
- Directive controls direct an activity towards certain desired outcomes.
- Preventative controls limit the possibility of an undesirable event happening.
- Corrective controls correct undesirable outcomes after they have happened.

Internal audit evaluates the effectiveness of control systems and contribute to their ongoing effectiveness. Do keep in mind, no control is perfect. This is why an internal control system can provide only reasonable assurance. There are limitations in all internal control systems that are simply impossible to remove.


NOTE: One straight forward way to evaluate the existing control arrangements is to weigh up the cost of operating the control against the risk or benefit that the control has been designed for.

Everyone in the business units should be held responsible for internal controls. While the Audit Committee would ultimately be responsible for maintaining an adequate system of financial and administrative controls at the organization, the department head should be the one responsible for internal controls in the corresponding department and should take ownership of the internal control system. The department head should set the "tone" for the department by influencing the control consciousness of staff and communicating an administrative philosophy that includes integrity, ethical values and competence.

Controls can be in the form of policies, methodologies, technologies or other simple arrangements. The core idea, however, is the separation of duties – this is especially critical when handling incoming and outgoing payments.